Privacy Policy
English translation; the Turkish text prevails.
Handover is a service that makes social media posts for small businesses from their own photographs. It is provided by ZADE TECH YAZILIM ANONİM ŞİRKETİ (MERSİS 0996149395300001; Atatürk Mah. 537 Sk. No: 4, Güzelbahçe / İZMİR, Türkiye). This policy explains what we collect, why and how we use it, who we share it with, and how to have it deleted. Your legal rights over personal data and our legal bases are in the KVKK Personal Data Notice.
1. In short
- We collect only what the service needs.
- We don't sell your data or share it for advertising.
- Our site has no advertising or tracking cookies, pixels or analytics.
- No post is published without both a machine check and the business owner's approval.
- You can ask us to delete your data at any time (section 7).
2. What we collect
What you give us:
- Your business's website address, and your corrections (for example, how you describe your business).
- Photographs you upload, and their file names; and your logo, if you upload one.
- The look of your posts: the name as you want it printed, colours, typefaces, the feel, and a slogan if you write one.
- Your choices about posts: edits, schedules, approvals and rejections.
- What you write to us.
- When you accept the Terms, we record which version of the Terms you accepted and which version of the KVKK Personal Data Notice you were shown, and when; how long we keep it is in section 1.2 of the Terms.
- What Google gives us when you sign in with Google: your Google account's identifier, your e-mail address and whether Google has verified it. We take nothing else (no name, photo or language). We use it only to sign you in and run your account. We don't use it for advertising, and we don't sell or share it.
What we read from your business's website (automatically, when you give us its address): the business name, descriptions, products, logo, colours, typefaces, contact details and opening hours published there, customer reviews, and its photographs. We use this content only to make posts for your business.
What is created automatically: your IP address and browser details (for sign-in and session security), system logs, a tamper-proof audit log of what is done in your workspace and when (who approved or refused which post, who confirmed claims on a post, who confirmed the brand's look, edits, downloads, uploads, and changes of plan or setting, a plan entered with a coupon included), and a record of which model prepared a post (we don't store the prompts sent to the model). An approval given through a review link is recorded by the link's own number, not by a name. For a change to a brand's look it also holds what it was changed from and to.
When you apply a coupon, we also keep a record of it: the coupon's code, your workspace and account, the time you applied it, which versions of the business declaration and of the Terms you were shown, the plan and end time shown to you, your language and your IP address. We use it to prove what you were shown and accepted, and to apply the coupon's limit on use. How long we keep it is in section 6 of the KVKK Personal Data Notice.
What we receive from social accounts you connect: detailed in section 3.
3. What we receive from Instagram, Facebook and TikTok, and why
We connect your Instagram account, Facebook Page or TikTok account only if you connect it. You can disconnect it at any time in Handover, or remove the app's access in Instagram's, Facebook's or TikTok's settings.
Publishing runs through Meta's and TikTok's own platforms, under their rules and subject to their availability. Our status page shows what is live today.
Instagram (through Meta's "Instagram Login"):
| Permission | What we receive or do | Why |
|---|---|---|
instagram_business_basic | your account id (user_id), username, account type and media count | to show we publish to the right account, and to confirm it is a professional account |
instagram_business_content_publish | we publish the post you approved (image or video, and caption) to your account, and read its link (permalink) and status | to publish your approved post on time and show you it went out |
| (both) | the access tokens Meta issues | to do the above on your behalf. Stored encrypted |
We don't receive your followers, insights, comments, messages or existing posts from Instagram. We never ask for or see your Instagram password.
Facebook (through Meta's "Facebook Login"):
| Permission | What we receive or do | Why |
|---|---|---|
pages_show_list | When you connect a Page, the list of Pages you can post as, with each one's name and id. We keep only the Page you choose. If you have more than one Page, the list waits while you choose, for at most fifteen minutes, and is deleted as soon as you have chosen or cancelled | so you can choose the Page |
pages_manage_posts | When you connect a Page and approve a post for it, we publish the post (photographs or video, and caption) to that Page, and remove it if you press Remove from Facebook | to publish your approved post |
pages_read_engagement | We read back the one post we made: its link and, for a video, its processing status. Nothing else on your Page | to show you it went out |
| (all) | The access token Meta issues for the Page, and your Facebook app-scoped user id (a number Facebook gives our app for you). While you choose between several Pages, we also hold an access token Meta issued for you, for at most fifteen minutes, and delete it as soon as you have chosen or cancelled. Tokens are stored encrypted. | to do the above on your behalf, and to find the connection if Meta tells us you asked for your data to be deleted |
We don't receive your Facebook name, e-mail address or picture, your Page's followers, insights, comments, messages or other posts, or who else runs your Page. We never ask for or see your Facebook password. A post on a Page is public.
TikTok:
| Permission | What we receive or do | Why |
|---|---|---|
user.info.basic | your open_id and display name | to show we publish to the right account |
| (posting screen) | the nickname, username, profile-picture link and allowed privacy options TikTok returns before posting | to show the posting screen TikTok's rules require. We don't store these |
video.publish | we send the post you approved, with the settings you chose, and read its processing status | to publish your approved post |
| (all) | the access and refresh tokens TikTok issues | to do the above on your behalf. Stored encrypted |
AI labels. We tell Instagram, Facebook or TikTok that a post is AI-made only when its picture, video or sound was made by an AI model, so that the platform can show its own AI label. We don't send that mark for a post whose words an AI model helped write.
4. How we use data
- To make posts for your business from your own photographs.
- To check each post automatically before it can be published (legibility, overflow, safe area, claims such as prices, health or comparisons), and to put it to you for approval.
- To publish the posts you approve on time, to the accounts you connected.
- To protect your account and our systems, limit abuse and fix faults.
- To prove what you were shown and what you approved or accepted, and to apply a coupon's limit on use.
- To meet our legal obligations.
- If you joined the waitlist, with your consent, to email you the announcement that sales have opened and product news (section 13).
We tell you before we use your data for any other purpose.
5. Who we share it with
We don't sell it. We don't sell, rent, license or share for advertising your personal data or any data from Instagram, Facebook or TikTok.
We share data only as far as the service needs, with these providers:
| Who | For what | Where |
|---|---|---|
| Amazon Web Services (CloudFront, S3) | hosting this site and serving it to you: your requests to our website (IP address, browser information, the page requested) pass through it. We keep no request log | the site's files in Germany (Frankfurt); pages are served from the CloudFront location nearest you |
| Google (Gemini API, paid) | making and checking posts: photographs, business information (your slogan too, if you wrote one), post text. Google says that in the paid service it doesn't use them to improve its products, and logs them for a limited period (55 days) to prevent abuse | Google's facilities |
| Google (sign-in with a Google Account) | when you choose "Continue with Google", your browser goes to Google and Google tells us who you are. Google handles that under its own privacy policy. It is a different service from the Gemini API row, and it receives none of your posts or photographs | Google's facilities |
What we share for the waitlist is in section 13.
We send the posts you approve, on your instruction, to Instagram and Facebook (Meta) and TikTok, where each platform's own privacy policy applies. We may share data with authorities where the law requires it.
6. How long we keep it
- When you disconnect Instagram, Facebook or TikTok, the access tokens are deleted at once.
All periods are in section 6 of the KVKK Personal Data Notice.
To stop Google sharing data with Handover, you can remove Handover's access in your Google Account's settings; to have what we hold deleted, use the routes in section 7.
7. How to have your data deleted
Every user, including those whose data came from Instagram, Facebook or TikTok, can ask for deletion:
- Only the tokens Instagram, Facebook or TikTok gave us: disconnect the account in Handover. The access tokens are deleted at once.
- By e-mail: from your registered address, write "Delete my data" to support@zadetech.com. We answer within 30 days.
Step by step: the Data Deletion Instructions.
The tamper-proof audit log, which records what is done in a workspace and when (approvals and refusals above all, and also confirmations of claims, edits, downloads, uploads and changes of plan or setting), isn't deleted on request; it is kept for 5 years after the contract ends (the Terms, section 11.4, say when that is), and we tell you so in writing.
8. Cookies and browser storage
We don't use advertising, tracking or analytics cookies. There are only these:
| Name | When | What for | How long |
|---|---|---|---|
handover_session | When you sign in, on the website or in the app | Keeps you signed in. JavaScript cannot read it (HttpOnly). | Until you close the browser, and 24 hours at most. If you tick “Remember me” when you sign in, 30 days, renewed as you use it. Deleted when you sign out. |
| Name | What for | How long |
|---|---|---|
handover.locale | The language you chose on the website, or in the language menu in the app's sidebar | Until you clear it, on this device only |
handover.desk.language | The language you chose with the English / Türkçe buttons in the payment step of the Plan screen | Until you clear it, on this device only |
handover.funnel | Your answers in the first steps, so they are not lost if you stop halfway | This tab only; cleared when you close it |
handover.orgId, handover.brandId | The workspace you last opened in the app | Until you clear it, on this device only |
handover.signIn.remember | Whether you ticked “Remember me” when you asked for a sign-in e-mail, so that it also holds when you sign in with the link in that e-mail | Written only when you ask for a sign-in e-mail, and read for 15 minutes; removed when you sign in. On this device only |
You can clear these in your browser settings.
9. Security
- Instagram, Facebook and TikTok access tokens are stored encrypted with AES-256-GCM, under a separate key for each account.
- Approvals, refusals and the other things done in a workspace are written to an audit log that the application cannot change or delete afterwards.
- If a post is changed after approval, the approval lapses and the post needs approving again.
- Client approval links are signed, limited to one client, and expire after 14 days.
If a data breach occurs, we tell you and the Personal Data Protection Board as soon as possible, as the law requires.
10. Reporting a security vulnerability
If you've found a security vulnerability in Handover, please write to support@zadetech.com. We'll answer as soon as we can.
11. Children
Handover is a service for businesses. It is not meant for anyone under 18, and we don't knowingly collect their data.
If you are in the European Union, the European Economic Area or the United Kingdom
The controller of your account data is ZADE TECH YAZILIM ANONİM ŞİRKETİ, established in Türkiye. We process it to perform our contract with you or your business (GDPR Art. 6(1)(b)), to meet legal duties such as keeping invoice and order records (Art. 6(1)(c)), and for our legitimate interest in keeping the Service secure, being able to prove approvals and what you were shown, and applying a coupon's limit on use (Art. 6(1)(f)). Your data is stored in Germany; it is also processed in Türkiye, where we are, and by the providers listed in section 5. The European Commission has not adopted an adequacy decision for Türkiye. You have the right to access your data, to have it corrected, erased or its processing restricted, to object to processing, and to receive it in a portable form. Write to support@zadetech.com, in English or Turkish; we answer within one month. You may complain to the data protection authority of the country where you live (in the United Kingdom, the Information Commissioner's Office). For personal data in the content a business uploads, that business is the controller, and we process it on its behalf.
12. Changes and contact
If we change this policy, we publish the current version on this page. When you have an account, we will tell you about significant changes by e-mail in advance.
Contact: ZADE TECH YAZILIM ANONİM ŞİRKETİ, Atatürk Mah. 537 Sk. No: 4, Güzelbahçe / İZMİR, Türkiye · support@zadetech.com
13. The waitlist
- We keep your name and email address. Until we are able to email the list lawfully, the only email we send it is the one confirming your sign-up.
- You can join the waitlist from the form on the site. Joining is optional: nothing is added unless you tick the box and press Join.
- If you join the waitlist, we keep your name, your email address, your business name (if you give one) and a record of your consent, only to send you the email announcing that sales have opened, and product news, by email.
- We store the list on Amazon Web Services' servers in Frankfurt and send the emails from there.
- Within 24 hours of joining, you get an email confirming your consent.
- To limit repeated attempts from one place (at most 5 an hour), we keep a one-way digest of your IP address, made with a secret key, in a counter that expires within 2 hours and is then deleted by the database by itself. Your IP address itself is not stored.
- You can leave at any time: with the link in every email, or by writing to support@zadetech.com. We stop emailing you within three business days. We keep the record of your consent for 3 years as proof, then delete it.
- Legal bases, periods and your rights: the KVKK Personal Data Notice, section 10.